The General Data Protection Regulation (GDPR), which will be introduced on May 25th 2018, is set to have an impact on all member states of the European Union, as well as on nations handling the data of EU citizens.<\/p>\n
However, with just over a year to go, research from the DMA<\/a> suggests that over a quarter (26%) of marketers feel their business is unprepared for the GDPR.<\/p>\n So what can companies do to ensure they are compliant? Here are 10 simple steps organizations can take.<\/p>\n In a blog last year, Steve Wood, head of international strategy and intelligence at the Information Commissioner\u2019s Office (ICO), allayed concerns over Brexit, stating<\/a> that \u201conce implemented in the EU, the GDPR will be relevant for many organizations in the UK\u201d.<\/p>\n It means that while the UK may be preparing itself for an exit from the EU, many of its businesses and organizations will still be subject to GDPR compliance (and, after all, enterprises in the UK will still be handling EU data).<\/p>\n It is important to ensure that all the important decision makers within your organization are aware of the implications of GDPR and what it means to their everyday operations.<\/p>\n According to Gigamon\u2019s 2017 UK Cyber Readiness Survey<\/a>, only 41% of IT professionals said they were \u201cfully aware\u201d of the implications of GDPR, while 9% said they had no awareness at all.<\/p>\n These figures suggest there is clearly some work to be done to ensure all organizations are on board with the new proposals.<\/p>\n Under the current EU Data Protection Directive, only data controllers are liable when it comes to data protection compliance.<\/p>\n But as the ICO explains,<\/a> GDPR places direct statutory obligations on data processors too.<\/p>\n It is therefore important to establish whether your organization is a data processor or a data controller, bearing in mind it could be both.<\/p>\n Auditing your current methods is one of the best ways in which to prepare for GDPR, meaning that a thorough understanding of how your organization deals with data is paramount.<\/p>\n It\u2019s important to establish where personal data is being stored, before assessing the security of that location, who is responsible for controlling that data<\/a>, and whether it is being shared.<\/p>\n Getting your IT department involved with this process is crucial and will give you a better idea of the current capabilities of your organization.<\/p>\n Examining any previous data breaches to your system will give you a clearer idea of your organization\u2019s capabilities in reacting to future attacks, and offer a better picture on whether those procedures are capable of meeting future requirements.<\/p>\n \u201cData breaches will need to be reported within 72 hours of being discovered.\u201d<\/span><\/p>\n One of the standout measures set to be introduced under the GDPR is that data breaches will need to be reported within 72 hours<\/a> of being discovered, along with information detailing the nature and severity of the attack.<\/p>\n With the threat of significant fines for any organization that fails to comply, there is ample incentive for organizations to get their houses in order.<\/p>\n According to the IAPP<\/a>, DPOs will be essential for public authorities or other organizations engaged in activities regularly monitoring data subjects on a large scale.<\/p>\n The DPO acts independently and will report to the very highest level of management within the organization.<\/p>\n Their main responsibility is to have an impeccable understanding of GDPR, and to implement the requirements needed in order to gain consent.<\/p>\n One of the key takeaways from GDPR is the strengthening of rights for individuals,<\/a> including the right to be forgotten and data portability, which means you could be required to provide data to an individual that can then be taken to a competitor.<\/p>\n Businesses are obliged to promote these rights, so it is important to ensure there are procedures in place to make this possible.<\/p>\n The GDPR aims to offer more clarity<\/a> when it comes to the issue of consent. New measures will require companies to gain an explicit statement or \u201cclear affirmative action\u201d<\/a> when it comes to data processing.<\/p>\n Companies will be subject to new measures restricting the ability of children to give their consent to data processing without parental permission.<\/p>\n \u201cOne of the key takeaways from GDPR is the strengthening of rights for individuals.\u201d<\/span><\/p>\n It is therefore worth examining what practices are already in place when it comes to making data subjects aware of how their information is going to be used and processed.<\/p>\n Many of the organizations affected by GDPR will be operating internationally, and may subsequently be subject to other directives that go beyond the GDPR.<\/p>\n It can be tricky to work out which data protection supervisory authority takes the lead when a complaint is investigated, but according to Article 56 of the GDPR, it is determined by the location of the organization\u2019s main administration<\/a> in the EU.<\/p>\n This can be difficult to work out for companies with multiple sites, so if there is any uncertainty, it is important to establish where significant decisions regarding data processing are made, as this is likely to be your lead supervisory authority.<\/p>\n All of these considerations can place a great deal of strain on an organization\u2019s infrastructure, so it is therefore essential that companies allocate added resources in which to meet these demands.<\/p>\n1. Keep planning for GDPR <\/b><\/h2>\n
2. Raise awareness<\/b><\/h2>\n
3. Establish how your organization deals with data<\/b><\/h2>\n
4. Examine every facet of data handling in your organization <\/b><\/h2>\n
5. Examine previous breaches <\/b><\/h2>\n
6. Appoint a data protection officer (DPO)<\/b><\/h2>\n
7. Be aware of rules surrounding the rights of individuals <\/b><\/h2>\n
8. Get educated on consent<\/b><\/h2>\n
9. Identify your lead supervisory authority<\/b><\/h2>\n
1o. Allocate more resources<\/b><\/h2>\n